Why fraud against small businesses got better

The defences that stopped working

For twenty years small businesses filtered fraud on surface cues. Odd phrasing. A generic greeting. A supplier email that did not sound like the person who usually writes it.

All three are now cheap to fix. A fraudulent email can be written in fluent, idiomatic English, or in your own language, personalised from your public website and your staff page, referencing a real project. None of that requires skill any more.

This is the most concrete way AI has changed risk for small businesses, and it has nothing to do with whether you use AI yourself.

The three attacks that actually land

Invoice redirection. Someone watches a real email thread (often through a compromised mailbox at your supplier, not yours) and at the right moment sends a message saying the bank details have changed. It arrives in the real thread, in the right tone, at the moment an invoice was expected. This is the single most expensive fraud against small businesses in most reported figures, and AI has made the writing indistinguishable.

Voice cloning. A few seconds of audio is now enough to produce a convincing clone. Your voice is on your website video, your voicemail greeting, an interview. The call goes to whoever handles payments, from a spoofed number, and it is the boss asking for an urgent transfer. Cases of this are well documented and the amounts are large.

Fake suppliers and fake customers. Plausible websites, complete catalogues, real-looking company details, all produced in an afternoon.

The one defence that works

Verification on a channel the attacker does not control.

Concretely: any change to bank details, and any payment above a threshold you set, is verified by calling a number you already had: from your records, not from the email, not from the caller display, not from the signature block.

That is it. It defeats all three attacks above, because it does not depend on judging whether the message looked right. It is also the control most small businesses do not have, because it feels rude to ring a supplier to check.

Say so out loud with your suppliers and customers, in advance: we always ring to confirm bank detail changes, and we would like you to do the same with us. It stops being awkward the moment both sides expect it.

A code word for voice

For the voice-clone case, agree a word or a question with anybody who can authorise a payment. Something not on the internet: not a pet’s name, not a school. Asked and answered in ten seconds.

This sounds theatrical until you consider the alternative, which is deciding whether a voice you know well is them, under time pressure, while they are insistent.

The other direction: what your own assistant gives away

Fraud also arrives through the tools you deployed. A website assistant grounded in your documents will answer questions asked by anybody, including somebody building a convincing approach to your staff.

Ask your own bot who handles your accounts, which bank you use, when the owner is away, and what your payment terms are. If it answers, that information is now a public resource, assembled and phrased helpfully.

The fix is the one from module four: ground it in a deliberately chosen set of documents rather than everything you have, and keep staff names, roles and internal process out of that set.

Urgency is the signal

The one cue that survives is pressure. Nearly every one of these attacks needs you to act before you check: the payment is late, the boss is in a meeting, the account will be closed.

Make that explicit in your process. Urgency is a reason to slow down, and any genuine counterparty will accept a ten-minute delay for verification. The ones who will not are telling you something.

What this means for a small business

Two hours of work, once. Write down the payment rule with the threshold and the callback. Agree the code word. Tell your suppliers. Tell whoever can move money that they will never be criticised for delaying a payment to verify it, and that the criticism runs the other way.

Then the honest part: no filter, no tool and no amount of vigilance replaces the callback. The attacks are now good enough that judging the message is the wrong game to be playing, and moving the decision to a channel you already trusted is the only reliable way out of it.